Executive brief
The Linux kernel's eBPF just-in-time compiler for RISC-V CPUs has a bug in how it generates exception handling for certain atomic memory operations called "load_acquire" on eBPF arena memory. When such an operation faults, the kernel crashes instead of handling it gracefully, and sensitive register values can leak to unprivileged programs through memory maps.
Technical details
This is a logic error in the eBPF JIT compiler's exception handling for RISC-V (arch/riscv/net/bpf_jit_comp64.c). The emit_atomic_ld_st() function returns 1 to signal the caller to skip zero-extension, but the caller's control flow (ret ?: add_exception_handler(...)) incorrectly skips adding an exception table entry when ret is non-zero. This means faulting PROBE_ATOMIC load_acquire operations cause kernel oopses instead of controlled fault handling. Additionally, REG_DONT_CLEAR_MARKER leaves the destination register stale on fault, allowing the verifier to believe the load succeeded, enabling unprivileged eBPF programs to leak the stale value through maps. The fix checks ret >= 0 before calling add_exception_handler(), passes the proper register (rd) for LOAD_ACQ so faults zero it correctly, and preserves the ret value for zero-extension skipping.
Affected products
- Linux Linux kernel RISC-V eBPF JIT in 5.x through 6.x (see Fixes: fb7cefabae81)
Timeline
- 2026-09-17: disclosed
- 2026-07-20: patched: Fix committed upstream; backported to stable branches